VLANs allow different physical local area networks to communicate with each other using layer 2 switches, rather than layer 3 routers. From a messaging standpoint, VLANs are implemented by inserting a VLAN identifier in a layer 2 frame. Layer 2 switches are configured to switch and control flooding of traffic based on VLAN identifiers. For example, when layer 2 traffic arrives at a switch and has a particular VLAN identifier, if a layer 2 forwarding database entry is not present in the forwarding table for the layer 2 traffic, the layer 2 traffic is only flooded onto ports of the switch associated with the same VLAN identifier. Thus, VLAN identifiers are used to control the distribution of layer 2 traffic.
One problem with using VLAN identifiers to control the distribution of layer 2 traffic occurs when different networks connected to the same layer 2 switch use the same VLAN identifiers. For example, network A may assign the VLAN identifier 23 to its layer 2 traffic. Network B may also assign the VLAN identifier 23 to its layer 2 traffic. When layer 2 frames destined for network A arrive at a layer 2 switch, if a specific layer 2 forwarding table entry does not exist for the destination in network A, the frame intended for the destination in network A will be flooded to networks A and B. Flooding traffic onto another user's network is undesirable for security reasons and it also unnecessarily wastes network bandwidth.
One solution to the problem of VLAN identifier assignment is to require different networks to use different VLAN identifiers. While assigning separate VLAN identifiers to separate networks prevents the flooding problems mentioned above, it unnecessarily limits the VLAN assignment capabilities of each network. For example, each network may desire to flexibly assign VLAN identifiers, without regard to VLAN identifiers assigned to other networks. Limiting one network to a specific VLAN identifier or set of VLAN identifiers is undesirable from a service provider perspective because it limits customers and can require customers to reconfigure their internal networks.
Another potential solution to VLAN identifier conflicts is to use a virtual metropolitan area network (VMAN) identifier in addition to VLAN identifiers to segregate traffic from different customers. The VMAN identifier may be added to layer 2 frames upon entry into a layer 2 service provider's network. The VMAN identifier is used to switch the traffic within the layer 2 service provider's network and is removed when the traffic leaves the layer 2 service provider's network. However, using VMAN identifiers still does not solve the problem of flexible VLAN assignment. For example, if two customers use the same VLAN ID, there must still be a way to segregate this traffic at the egress point of the layer 2 service provider's network. Such segregation may require that each customer be assigned to different VMAN ID upon ingress to the layer 2 service provider's network, based on some suitable criteria. Thus, while a VMAN-based solution allows traffic to be switched in a VMAN service provider's network without using VLAN IDs, there still exists a need for a solution to how to separate the traffic of different customers that use the same VLAN IDs at the ingress and egress points of the service provider's network.
Yet another potential solution to the problems of VLAN identifier assignment and traffic segregation is to use access lists to control how traffic is forwarded on different ports of a switch. For example, an access list may specify that only layer 2 traffic from a particular set of MAC source addresses can be forwarded on a particular output port, regardless of the VLAN identifier. Layer 2 access lists can thus control the traffic that is sent over each port in a layer 2 switch. However, using access lists is cumbersome because access lists must be implemented on a per-port basis and must be updated when MAC source addresses change due to equipment changes or when new machines are connected to the layer 2 switch.
U.S. Pat. No. 6,208,649 to Kloth discloses a derived VLAN mapping technique that assigns derived VLAN values based on port VLAN and either MAC address or protocol type. In particular, the '649 patent discloses that in one embodiment, the protocol type defined in the layer 2 portion of the packet can be combined with the port VLAN to select a derived VLAN. This embodiment allows packets of different protocol types, such as IP and IPX, that arrive on the same port to be sent over different output ports. However, this embodiment requires a fixed association between port and VLAN and does not address the problem of two customers desiring to assign the same VLAN identifier to different ports. If two customers use the same VLAN identifier and the same protocol type, their traffic will be mixed, according to the solution disclosed in the '649 patent. Since a layer 2 service provider should not limit the type of layer 3 traffic produced by its customers, deriving VLAN values based on protocol type is undesirable.
In the subnet-based VLAN embodiment described in the '649 patent, the IP subnet is combined with the port VLAN to determine a derived VLAN value. This embodiment allows VLANs to be divided into different IP subnets. However, this embodiment requires decoding of the IP portion of the message, which is a layer 3 function, to determine the derived VLAN. In addition, a fixed association between port and VLAN is still required.
In a third embodiment, the '649 patent discloses that an index value, rather than the port VLAN can be used to determine the derived VLAN value. The index value is disclosed as being assigned to the input port. This embodiment is undesirable because it only allows a number derived VLANs equal to the number of ports in a switch.
Accordingly, in light of the problems associated with conventional VLAN identifier assignment and traffic segregation techniques, there exists a long felt need for improved methods and systems for selectively processing VLAN traffic from different networks while allowing flexible VLAN identifier assignment.